
- Ink Dragon campaign breaches European governments by exploiting misconfigured IIS and SharePoint servers
- The group uses its FinalDraft backdoor to blend C2 traffic with normal Microsoft cloud activity
- Dozens of government and telecom entities worldwide were turned into relay nodes for further operations
Ink Dragon, a known Chinese state-sponsored threat actor, has extended its reach into European governments, using misconfigured devices for initial entry, and establishing persistence by blending with regular traffic, experts have warned.